Pareto-optimal Defenses for the Web Infrastructure: Theory and Practice

Abstract

The integrity of the content a user is exposed to when browsing the web relies on a plethora of non-web technologies and an infrastructure of interdependent hosts, communication technologies, and trust relations. Incidents like the Chinese Great Cannon or the MyEtherWallet attack make it painfully clear: the security of end users hinges on the security of the surrounding infrastructure: routing, DNS, content delivery, and the PKI. There are many competing, but isolated proposals to increase security, from the network up to the application layer. So far, researchers have focus on analyzing attacks and defenses on specific layers. We still lack an evaluation of how, given the status quo of the web, these proposals can be combined, how effective they are, and at what cost the increase of security comes. In this work, we propose a graph-based analysis based on Stackelberg planning that considers a rich attacker model and a multitude of proposals from IPsec to DNSSEC and SRI. Our threat model considers the security of billions of users against attackers ranging from small hacker groups to nation-state actors. Analyzing the infrastructure of the Top 5k Alexa domains, we discover that the security mechanisms currently deployed are ineffective and that some infrastructure providers have a comparable threat potential to nations. We find a considerable increase of security (up to 13% protected web visits) is possible at relatively modest cost, due to the effectiveness of mitigations at the application and transport layer, which dominate expensive infrastructure enhancements such as DNSSEC and IPsec.

Lifted Stackelberg Planning

“…We run experiments on Speicher et al's (2018a) Stackelberg variants of IPC and pentesting benchmarks, on variants of these benchmarks scaled to have many objects, and on web infrastructure defense-attack models as per Tizio et al (2022). Our experiments show that, while lifted Stackelberg planning is inferior on small tasks, it is typically vastly superior on large tasks.…”

“…Stackelberg planning is a natural tool for analyzing countermeasures in security applications, e.g., network penetration testing (Boddy et al 2005;Hoffmann 2015) or emailinfrastructure threat analysis (Speicher et al 2018b), the leader modeling defense mechanisms against attack vectors represented by the follower. Recently, Tizio et al (2022) used Stackelberg planning for analyzing the open web infrastructure, but found that off-the-shelf planners suffer from poor scalability. With instances that easily contain many thousands of objects, Tizio et al quickly identified the grounding preprocess as a major bottleneck.…”

On the Computational Complexity of Stackelberg Planning and Meta-Operator Verification

“…The objective of the first player (called the leader) is to choose and to play a plan that maximally raises the cost of the second player (the follower) to subsequently achieve its goal. This type of planning is useful for real-world adversarial settings commonly found in the cyber-security domain (Speicher et al 2018b;Di Tizio et al 2023). To solve Stackelberg planning tasks, there so far exists just a single generic algorithm paradigm called leader-follower search (Speicher et al 2018a), which searches over possible leader plans, solving a classical planning task for each.…”